Configure jflow v5 get error: interface-name: 'xxx': Must be a services interface

Question

friends:

When I configure the jflow v5 on my MX-480:

=====

admin@USA-MX-RE0# show forwarding-options sampling    
instance {
    MONITOR-FLOW {
        input {
            rate 1000;
        }
        family inet {
            output {
                ##
                ## Warning: Output 'interface' or 'inline Jflow' should be configured with flow-server
                ##
                flow-server 23.224.24.253 {
                    port 50001;
                    source-address 23.224.24.1;
                    version 5;
                }
            }
        }
    }
}

{master}[edit]
admin@USA-MX-RE0# set forwarding-options sampling instance MONITOR-FLOW family inet output interface lo0.0 
error: interface-name: 'lo0.0': Must be a services interface
error: statement creation failed: interface

{master}[edit]
admin@USA-MX-RE0# set forwarding-options sampling instance MONITOR-FLOW family inet output interface lo0      
error: interface-name: 'lo0': Must be a services interface
error: statement creation failed: interface

{master}[edit]
admin@USA-MX-RE0# set forwarding-options sampling instance MONITOR-FLOW family inet output interface ae17.10 
error: interface-name: 'ae17.10': Must be a services interface
error: statement creation failed: interface

{master}[edit]
admin@USA-MX-RE0# set forwarding-options sampling instance MONITOR-FLOW family inet output interface fp         
                                                                                                    ^
invalid interface type in 'fp' at 'fp'
admin@USA-MX-RE0# set forwarding-options sampling instance MONITOR-FLOW family inet output interface fpc         
                                                                                                    ^
invalid interface type in 'fpc' at 'fpc'
admin@USA-MX-RE0# set forwarding-options sampling instance MONITOR-FLOW family inet output interface fpc0   
                                                                                                    ^
invalid interface type in 'fpc0' at 'fpc0'

{master}[edit]
admin@USA-MX-RE0# set forwarding-options sampling instance MONITOR-FLOW family inet output interface ?      
Possible completions:
  <interface-name>     Interfaces used to send monitored information
{master}[edit]


====

I don't know which interface should configure in there.

===

My other configuration:

admin@USA-MX-RE0# show services flow-monitoring 
version-ipfix {
    template TEMPLATE-PRTG-IPV4 {
        flow-active-timeout 300;
        flow-inactive-timeout 300;
        template-refresh-rate {
            packets 1000;
            seconds 10;
        }
        option-refresh-rate {
            packets 1000;
            seconds 10;
        }
        ipv4-template;
    }
}

{master}[edit]

---

admin@USA-MX-RE0# show chassis fpc 0 
pic 0 {
    tunnel-services {
        bandwidth 1g;
    }
}
sampling-instance MONITOR-FLOW;
inline-services {
    flow-table-size {
        ipv4-flow-table-size 8;
    }
}

{master}[edit]

Answer 1

First, it's important to understand the various flavors of NetFlow (J-Flow to Juniper) and the limitations.

• RE-Based Sampling: This is for J-Flow v5/v8. As the name implies, the RE does the work. As sampled packets ingress/egress an interface, the packet is copied to the RE for processing and export. There are scaling/hardware limitation for when the RE itself is doing it, Juniper does not recommend exceeding 1:1000 packet rate and will max out at 7000 pps. RE-Based sampling only supports IPv4 traffic.

• PIC Based Sampling: Similar to RE-Based Sampling except without the strict limitations, but requires specialized hardware.

• Inline Sampling: This is for v9/IPFIX. Instead of the RE or Services PIC doing the work, the FPC/PFE does. This is significantly easier to scale and with the newer formats, offers more options.

You can mix certain options, though there are some restrictions. I'm not sure if the fact that you have IPFIX referenced in your configuration if that is required, or simply an effort to get v5 to work. If it is required instead of/in addition to, I will update my answer, but for now, you're asking about v5, so I'll stick to v5.

I don't know which interface should configure in there.

You don't need an interface in this configuration. Specifying an interface implies you want to do Service PIC based sampling, which requires specialized hardware.

As for your "other configuration", you do not need a sampling-instance on the FPC or template.

RE-Based Sampling Configuration

Firewall Filter

If you don't already, you'll need a firewall filter on interfaces where traffic you want to sample flows. You'll want to add the filter as an ingress filter with family inet filter input SAMPLE. Specify whatever match conditions (if any) you want.

firewall {
    filter SAMPLE {
        term INET {
            then {
                sample;
                accept;
            }
        }
    }
}

Forwarding Options (Sampling)

Obviously change any of the sampling rates as needed.

forwarding-options {
    sampling {
        input {
            rate 1000;
            run-length 1;
            max-packets-per-second 7000;
        }
        family inet {
            output {
                flow-inactive-timeout 15;
                flow-active-timeout 60;
                flow-server 23.224.24.253 {
                    port 50001;
                    source-address 23.224.24.1;
                    version 5;
                }
            }
        }
    }
}